eblume/blumeops
1
1
Fork 0
Code Issues Pull requests Projects Releases 83 Packages Wiki Activity Actions
blumeops/docs/how-to/how-to.md

100 lines
1.8 KiB
Markdown
Raw Normal View History

Add Phase 4: how-to guides documentation (#95) ## Summary - Create `docs/how-to/` directory with index and four how-to guides - deploy-k8s-service: Quick reference for Kubernetes deployments via ArgoCD - add-ansible-role: Adding new Ansible roles for indri services - update-tailscale-acls: Modifying Tailscale ACL policies via Pulumi - troubleshooting: Diagnosing and fixing common issues - Update exploring-the-docs to include How-to section links - Update README.md to mark Phase 4 as complete ## Deployment and Testing - [x] Pre-commit hooks pass (including doc-links validator) - [ ] Build and deploy to docs.ops.eblu.me to verify rendering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/95
2026-02-03 20:17:24 -08:00
---
Update all docs titles to human-readable (#117) ## Summary - Updated frontmatter `title:` in all 63 doc cards from slug-case to human-readable (e.g. `borgmatic` → `Borgmatic`, `ai-assistance-guide` → `AI Assistance Guide`) - Titles now closely match file stems so `[[wiki-links]]` render naturally without alternate anchor text - Corrected titles that diverged from stems (e.g. `host-inventory` → `Hosts`, `grafana-alloy` → `Alloy`, `argocd-applications` → `Apps`) - Deleted `title-test-alpha.md` and `title-test-beta.md` test cards and removed their reference index entry ## Deployment and Testing - [x] `docs-check-links` passes — all wiki-links valid - [x] `docs-check-index` passes - [x] `docs-check-filenames` passes - [ ] Verify titles render correctly on docs site after deploy Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/117
2026-02-07 21:44:57 -08:00
title: How-To
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
modified: 2026-03-06
last-reviewed: 2026-03-06
Add Phase 4: how-to guides documentation (#95) ## Summary - Create `docs/how-to/` directory with index and four how-to guides - deploy-k8s-service: Quick reference for Kubernetes deployments via ArgoCD - add-ansible-role: Adding new Ansible roles for indri services - update-tailscale-acls: Modifying Tailscale ACL policies via Pulumi - troubleshooting: Diagnosing and fixing common issues - Update exploring-the-docs to include How-to section links - Update README.md to mark Phase 4 as complete ## Deployment and Testing - [x] Pre-commit hooks pass (including doc-links validator) - [ ] Build and deploy to docs.ops.eblu.me to verify rendering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/95
2026-02-03 20:17:24 -08:00
tags:
- how-to
---
# How-To Guides
## Deployment
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
- [[deploy-k8s-service]]
- [[add-ansible-role]]
- [[create-release-artifact-workflow]]
- [[build-container-image]]
Add Phase 4: how-to guides documentation (#95) ## Summary - Create `docs/how-to/` directory with index and four how-to guides - deploy-k8s-service: Quick reference for Kubernetes deployments via ArgoCD - add-ansible-role: Adding new Ansible roles for indri services - update-tailscale-acls: Modifying Tailscale ACL policies via Pulumi - troubleshooting: Diagnosing and fixing common issues - Update exploring-the-docs to include How-to section links - Update README.md to mark Phase 4 as complete ## Deployment and Testing - [x] Pre-commit hooks pass (including doc-links validator) - [ ] Build and deploy to docs.ops.eblu.me to verify rendering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/95
2026-02-03 20:17:24 -08:00
## Configuration
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
- [[update-tailscale-acls]]
- [[gandi-operations]]
- [[use-pypi-proxy]]
- [[expose-service-publicly]]
- [[manage-forgejo-mirrors]]
- [[update-documentation]]
- [[update-tooling-dependencies]]
Add Phase 4: how-to guides documentation (#95) ## Summary - Create `docs/how-to/` directory with index and four how-to guides - deploy-k8s-service: Quick reference for Kubernetes deployments via ArgoCD - add-ansible-role: Adding new Ansible roles for indri services - update-tailscale-acls: Modifying Tailscale ACL policies via Pulumi - troubleshooting: Diagnosing and fixing common issues - Update exploring-the-docs to include How-to section links - Update README.md to mark Phase 4 as complete ## Deployment and Testing - [x] Pre-commit hooks pass (including doc-links validator) - [ ] Build and deploy to docs.ops.eblu.me to verify rendering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/95
2026-02-03 20:17:24 -08:00
Add doc-random task and documentation improvements (#98) ## Summary - Add `doc-random` mise task that selects a random documentation card for review - Add how-to/knowledgebase section with review-documentation guide - Add Caddy reference card with proxy configuration details - Fix replication tutorial sequence (tailscale-setup now links to core-services) - Fix "BluemeOps" typo in tailscale-setup - Clean up obsolete zk/ directory references from doc-links ## Deployment and Testing - [x] `mise run doc-random` works and displays a random card - [x] `mise run doc-links` passes (all wiki-links valid) - [x] Pre-commit hooks pass 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/98
2026-02-03 21:17:58 -08:00
## Knowledge Base
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
- [[review-documentation]]
- [[review-services]]
- [[agent-change-process]]
Add doc-random task and documentation improvements (#98) ## Summary - Add `doc-random` mise task that selects a random documentation card for review - Add how-to/knowledgebase section with review-documentation guide - Add Caddy reference card with proxy configuration details - Fix replication tutorial sequence (tailscale-setup now links to core-services) - Fix "BluemeOps" typo in tailscale-setup - Clean up obsolete zk/ directory references from doc-links ## Deployment and Testing - [x] `mise run doc-random` works and displays a random card - [x] `mise run doc-links` passes (all wiki-links valid) - [x] Pre-commit hooks pass 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/98
2026-02-03 21:17:58 -08:00
Add Phase 4: how-to guides documentation (#95) ## Summary - Create `docs/how-to/` directory with index and four how-to guides - deploy-k8s-service: Quick reference for Kubernetes deployments via ArgoCD - add-ansible-role: Adding new Ansible roles for indri services - update-tailscale-acls: Modifying Tailscale ACL policies via Pulumi - troubleshooting: Diagnosing and fixing common issues - Update exploring-the-docs to include How-to section links - Update README.md to mark Phase 4 as complete ## Deployment and Testing - [x] Pre-commit hooks pass (including doc-links validator) - [ ] Build and deploy to docs.ops.eblu.me to verify rendering 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/95
2026-02-03 20:17:24 -08:00
## Operations
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
- [[connect-to-postgres]]
- [[restart-indri]]
- [[manage-flyio-proxy]]
- [[restore-1password-backup]]
- [[troubleshooting]]
Add migration plan for Forgejo brew-to-source transition (#140) ## Summary - Add `docs/how-to/plans/migrate-forgejo-from-brew.md` — full Diataxis-style plan covering background, one-time migration steps, Ansible role changes (with exact code), verification checklist, and future considerations - Add `docs/how-to/plans/plans.md` — new plans subdirectory index for upcoming migration/transition plans - Update `docs/how-to/how-to.md` with a Plans section - Update `docs/tutorials/exploring-the-docs.md` to mention plans in the doc structure table and quick-path sections for Owner and AI audiences ## Test plan - [x] `docs-check-links` passes - [x] `docs-check-index` passes - [x] All pre-commit hooks pass Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/140
2026-02-10 10:18:53 -08:00
Retire plans directory, convert migrate-forgejo-from-brew to mikado card The plans/ directory predated the mikado method approach. Deleted all completed and abandoned plans, converted the still-relevant migrate-forgejo-from-brew into a lean mikado chain root card under how-to/forgejo/, cleaned up dangling wiki-links across docs, and fixed a stale "pre-commit" reference to "prek". Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-04 20:28:14 -08:00
## Forgejo
- [[migrate-forgejo-from-brew]]
Deploy Authentik identity provider (C2 Mikado) (#227) ## Summary C2 Mikado chain for deploying Authentik as the SSO identity provider, replacing Dex. This PR will evolve over multiple sessions. Each iteration adds documentation (prerequisite cards) and eventually code as leaf nodes are resolved. ## Current Mikado State - **Goal:** `deploy-authentik` (active) - **Leaf prerequisites:** - `build-authentik-container` — Build Nix container image - `provision-authentik-database` — Create PostgreSQL database on CNPG cluster - `create-authentik-secrets` — Create 1Password item with credentials ## Process refinements - Updated agent-change-process with lessons from first attempt: reset code before committing cards, open PRs early ## Test plan - [ ] `mise run docs-mikado` shows correct dependency chain - [ ] Leaf nodes can be worked independently - [ ] Container builds on ringtail - [ ] Authentik starts and reaches healthy state - [ ] Forgejo OAuth2 connector works Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/227
2026-02-20 12:55:59 -08:00
Update ringtail flake inputs, add flake-update pipeline (#240) ## Summary - Update all ringtail NixOS flake inputs (nixpkgs, disko, home-manager) to latest - Add `flake_update` Dagger function (`nix flake update`) alongside existing `flake_lock` (`nix flake lock`) - Add how-to guide for managing the ringtail lockfile - Update dagger and ringtail reference cards ## Deployment and Testing - [x] `mise run provision-ringtail` — deployed successfully, `changed=2` (repo + rebuild) - [x] `mise run services-check` — all services healthy - [x] Doc link and index checks pass Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/240
2026-02-22 08:17:52 -08:00
## Ringtail
Review how-to index: strip prose, add last-reviewed Removed descriptions, table formatting, and Mikado chain commentary from the how-to index — it should be links only. Added last-reviewed date. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 07:51:46 -08:00
- [[manage-lockfile]]
Update ringtail flake inputs, add flake-update pipeline (#240) ## Summary - Update all ringtail NixOS flake inputs (nixpkgs, disko, home-manager) to latest - Add `flake_update` Dagger function (`nix flake update`) alongside existing `flake_lock` (`nix flake lock`) - Add how-to guide for managing the ringtail lockfile - Update dagger and ringtail reference cards ## Deployment and Testing - [x] `mise run provision-ringtail` — deployed successfully, `changed=2` (repo + rebuild) - [x] `mise run services-check` — all services healthy - [x] Doc link and index checks pass Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/240
2026-02-22 08:17:52 -08:00
Create C2 Mikado cards for harden-zot-registry (#229) ## Summary - Replace the old pre-Mikado plan doc (`docs/how-to/plans/harden-zot-registry.md`) with a proper C2 Mikado chain in `docs/how-to/zot/` - Root goal: `harden-zot-registry` — enable OIDC + API key auth on zot with anonymous pull preserved - Three leaf prereqs: `register-zot-oidc-client`, `wire-ci-registry-auth`, `enforce-tag-immutability` - Add Zot section to `how-to.md` index, remove plan entry from plans index - All doc checks pass (`docs-check-links`, `docs-check-index`, `docs-mikado`) ## Changes - **New:** `docs/how-to/zot/harden-zot-registry.md` — C2 Mikado root goal - **New:** `docs/how-to/zot/register-zot-oidc-client.md` — Register OIDC client in Authentik - **New:** `docs/how-to/zot/wire-ci-registry-auth.md` — Wire CI push paths with registry auth - **New:** `docs/how-to/zot/enforce-tag-immutability.md` — Prevent version tag overwrites - **Deleted:** `docs/how-to/plans/harden-zot-registry.md` — Old plan doc (content absorbed into Mikado cards) - **Updated:** `docs/how-to/how-to.md` — Add Zot section, remove plan entry - **Updated:** `docs/how-to/plans/plans.md` — Remove plan entry 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/229
2026-02-20 17:56:25 -08:00
## Zot
- [[harden-zot-registry]]
- [[register-zot-oidc-client]]
- [[wire-ci-registry-auth]]
- [[enforce-tag-immutability]]
Add commit-based container tagging prereq to harden-zot-registry chain (#230) ## Summary - New Mikado card: `adopt-commit-based-container-tags` — replaces git-tag-triggered container builds with path-based main-branch triggers and manual workflow dispatch - Image tags become `vX.Y.Z-<sha>` (with `-main` suffix for main branch builds, `-nix` for Nix builds), tying versions to the actual bundled app version and exact source commit - `container-tag-and-release` mise task to be renamed to `container-build-and-release`, triggering workflow dispatch with the current HEAD SHA - Added as soft prereq to `harden-zot-registry` Mikado chain ## Test plan - [x] Pre-commit hooks pass (docs-check-index, docs-check-links, etc.) - [ ] Review card content for completeness 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/230
2026-02-20 18:26:27 -08:00
- [[adopt-commit-based-container-tags]]
Harden zot registry, pt 1 (#231) ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231
2026-02-20 22:50:01 -08:00
- [[add-container-version-sync-check]]
Add install-dagger-on-nix-runner Mikado card (#233) ## Summary - New Mikado card: the ringtail nix-container-builder runner lacks dagger, which the nix workflow needs for `dagger call nix-version` (authentik version extraction fallback) - Re-opens `adopt-commit-based-container-tags` with this new prerequisite - All other containers (11 Dockerfile-only, nettest + ntfy with nix) build fine — only authentik's nix build is blocked ## Deployment and Testing - Docs only, no deployment needed Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/233
2026-02-20 23:03:12 -08:00
- [[install-dagger-on-nix-runner]]
Harden zot registry, pt 1 (#231) ## Summary - Enable OIDC + API key authentication on zot with anonymous pull preserved - Enforce tag immutability for version tags - Adopt commit-SHA-based container image tagging Details in the [[harden-zot-registry]] Mikado chain (`mise run docs-mikado harden-zot-registry`). ## Test plan - [ ] Anonymous pull still works - [ ] Unauthenticated push fails (401) - [ ] CI container builds pass with new auth and tagging - [ ] `mise run services-check` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/231
2026-02-20 22:50:01 -08:00
- [[pin-container-versions]]
- [[add-dagger-nix-build]]
- [[fix-ntfy-nix-version]]
Create C2 Mikado cards for harden-zot-registry (#229) ## Summary - Replace the old pre-Mikado plan doc (`docs/how-to/plans/harden-zot-registry.md`) with a proper C2 Mikado chain in `docs/how-to/zot/` - Root goal: `harden-zot-registry` — enable OIDC + API key auth on zot with anonymous pull preserved - Three leaf prereqs: `register-zot-oidc-client`, `wire-ci-registry-auth`, `enforce-tag-immutability` - Add Zot section to `how-to.md` index, remove plan entry from plans index - All doc checks pass (`docs-check-links`, `docs-check-index`, `docs-mikado`) ## Changes - **New:** `docs/how-to/zot/harden-zot-registry.md` — C2 Mikado root goal - **New:** `docs/how-to/zot/register-zot-oidc-client.md` — Register OIDC client in Authentik - **New:** `docs/how-to/zot/wire-ci-registry-auth.md` — Wire CI push paths with registry auth - **New:** `docs/how-to/zot/enforce-tag-immutability.md` — Prevent version tag overwrites - **Deleted:** `docs/how-to/plans/harden-zot-registry.md` — Old plan doc (content absorbed into Mikado cards) - **Updated:** `docs/how-to/how-to.md` — Add Zot section, remove plan entry - **Updated:** `docs/how-to/plans/plans.md` — Remove plan entry 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/229
2026-02-20 17:56:25 -08:00
Deploy Authentik identity provider (C2 Mikado) (#227) ## Summary C2 Mikado chain for deploying Authentik as the SSO identity provider, replacing Dex. This PR will evolve over multiple sessions. Each iteration adds documentation (prerequisite cards) and eventually code as leaf nodes are resolved. ## Current Mikado State - **Goal:** `deploy-authentik` (active) - **Leaf prerequisites:** - `build-authentik-container` — Build Nix container image - `provision-authentik-database` — Create PostgreSQL database on CNPG cluster - `create-authentik-secrets` — Create 1Password item with credentials ## Process refinements - Updated agent-change-process with lessons from first attempt: reset code before committing cards, open PRs early ## Test plan - [ ] `mise run docs-mikado` shows correct dependency chain - [ ] Leaf nodes can be worked independently - [ ] Container builds on ringtail - [ ] Authentik starts and reaches healthy state - [ ] Forgejo OAuth2 connector works Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/227
2026-02-20 12:55:59 -08:00
## Authentik
- [[deploy-authentik]]
- [[build-authentik-container]]
- [[provision-authentik-database]]
- [[create-authentik-secrets]]
- [[migrate-grafana-to-authentik]]
Upgrade k8s forgejo-runner from v6.3.1 to v12.x (#249) ## Summary - C2 Mikado chain for upgrading the k8s forgejo-runner daemon (6 major versions behind) - Root goal card with two leaf prerequisites: workflow validation and config review - Ringtail runner is already at ~v12.6.4 via nixpkgs, no work needed there ## Mikado Chain ``` upgrade-k8s-runner (goal) ├── validate-workflows-against-v12 (leaf) └── review-runner-config-v12 (leaf) ``` Both leaves are actionable now. The biggest risk is workflow schema validation (introduced in v8/v9) rejecting our existing workflows. ## Next Steps Work the leaf nodes in a follow-up session, then attempt the goal. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/249
2026-02-22 17:12:45 -08:00
Start C2 Mikado chain: build authentik from source Create goal card and 4 prerequisite cards for building authentik from a custom Nix derivation instead of using pkgs.authentik from nixpkgs. This removes the dependency on the nixpkgs packaging timeline and gives full version control over authentik releases. Chain: mikado/authentik-source-build Leaf nodes: authentik-api-client-generation, authentik-python-backend-derivation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 08:20:17 -08:00
## Authentik Source Build
- [[build-authentik-from-source]]
C2: Build authentik from source (Mikado chain) (#274) ## Mikado Chain: build-authentik-from-source Replace `pkgs.authentik` from nixpkgs with a custom Nix derivation built from source. This removes the dependency on the nixpkgs packaging timeline and gives full version control. Target version: **2025.12.4** (nixpkgs reference, upgrading from deployed 2025.10.1). ### Dependency Graph ``` build-authentik-from-source (goal) ├── authentik-go-server-derivation │ ├── authentik-api-client-generation ← IN PROGRESS │ └── authentik-python-backend-derivation ├── authentik-web-ui-derivation │ └── authentik-api-client-generation ← IN PROGRESS └── authentik-python-backend-derivation ``` ### Ready Leaves - `authentik-api-client-generation` — Go + TypeScript client generation from OpenAPI schema - `authentik-python-backend-derivation` — Django backend with 60+ deps, 4 in-tree packages ### Architecture Ported from [nixpkgs `pkgs/by-name/au/authentik/package.nix`](https://github.com/NixOS/nixpkgs/tree/master/pkgs/by-name/au/authentik): - `source.nix` — shared version/source fetch - `client-go.nix` — Go API client generation - `client-ts.nix` — TypeScript API client generation - `api-go-vendor-hook.nix` — Go vendor directory injection hook - (more components to follow as leaves are closed) ### Related Cards - [[build-authentik-from-source]] — Goal card - [[authentik-api-client-generation]] - [[authentik-python-backend-derivation]] - [[authentik-web-ui-derivation]] - [[authentik-go-server-derivation]] Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/274
2026-03-01 13:45:00 -08:00
- [[mirror-authentik-build-deps]]
Start C2 Mikado chain: build authentik from source Create goal card and 4 prerequisite cards for building authentik from a custom Nix derivation instead of using pkgs.authentik from nixpkgs. This removes the dependency on the nixpkgs packaging timeline and gives full version control over authentik releases. Chain: mikado/authentik-source-build Leaf nodes: authentik-api-client-generation, authentik-python-backend-derivation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-28 08:20:17 -08:00
- [[authentik-api-client-generation]]
- [[authentik-python-backend-derivation]]
- [[authentik-web-ui-derivation]]
- [[authentik-go-server-derivation]]
Review Grafana: replace Helm upgrade plan with C2 Mikado chain (#258) ## Summary - Delete the old 3-phase Helm chart upgrade plan (predates Mikado system) - Create C2 Mikado chain with goal card `upgrade-grafana` and two leaf prereqs: - `kustomize-grafana-deployment` — convert Helm to kustomize manifests - `build-grafana-container` — home-built Grafana 12.x image (no upstream containers) - Record first-ever Grafana review: currently at v11.4.0 on Helm chart 8.8.2 - Update service-versions.yaml, how-to index, and plans index ## Service Review Findings - Grafana is healthy and synced in ArgoCD - Running v11.4.0, latest upstream is 12.3.3 - Breaking changes for 12.x are low-risk (React panels only, UIDs compliant) - PVC is disposable — dashboards and datasources are all config-provisioned ## Deployment and Testing - [ ] No deployment needed — documentation-only change - [ ] `docs-check-links` passes - [ ] `docs-check-index` passes Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/258
2026-02-23 15:06:00 -08:00
## Grafana
- [[upgrade-grafana]]
- [[kustomize-grafana-deployment]]
- [[build-grafana-container]]
Home-build grafana-sidecar container (#281) ## Summary - Home-build the k8s-sidecar container (`grafana-sidecar`) from forge mirror, replacing upstream `quay.io/kiwigrid/k8s-sidecar:1.28.0` - Pinned to v1.28.0 — v2.x deferred due to 135% memory regression and readOnlyRootFilesystem crashloop - Adds Dockerfile, service-versions entry, docs, and changelog fragment - Manifest switch to home-built image pending container build ## Deployment and Testing - [ ] `mise run container-build-and-release grafana-sidecar` - [ ] Update kustomization.yaml with built image tag - [ ] `argocd app set grafana --revision feature/grafana-sidecar && argocd app sync grafana` - [ ] Verify sidecar logs and dashboards at https://grafana.ops.eblu.me - [ ] Post-merge: `argocd app set grafana --revision main && argocd app sync grafana` Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/281
2026-03-03 13:48:24 -08:00
- [[build-grafana-sidecar]]
Review Grafana: replace Helm upgrade plan with C2 Mikado chain (#258) ## Summary - Delete the old 3-phase Helm chart upgrade plan (predates Mikado system) - Create C2 Mikado chain with goal card `upgrade-grafana` and two leaf prereqs: - `kustomize-grafana-deployment` — convert Helm to kustomize manifests - `build-grafana-container` — home-built Grafana 12.x image (no upstream containers) - Record first-ever Grafana review: currently at v11.4.0 on Helm chart 8.8.2 - Update service-versions.yaml, how-to index, and plans index ## Service Review Findings - Grafana is healthy and synced in ArgoCD - Running v11.4.0, latest upstream is 12.3.3 - Breaking changes for 12.x are low-risk (React panels only, UIDs compliant) - PVC is disposable — dashboards and datasources are all config-provisioned ## Deployment and Testing - [ ] No deployment needed — documentation-only change - [ ] `docs-check-links` passes - [ ] `docs-check-index` passes Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/258
2026-02-23 15:06:00 -08:00
Add how-to guide for upgrading Dagger Documents the correct two-phase upgrade procedure to avoid the chicken-and-egg problem where CI can't build its own replacement. Also fixes outdated version references in the Dagger reference card. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-06 20:31:30 -08:00
## Dagger
- [[upgrade-dagger]]
Deploy JobSync — job search tracker on ringtail k3s (#288) ## Summary C2 Mikado chain to deploy [JobSync](https://github.com/Gsync/jobsync) — a self-hosted job application tracker — to ringtail's k3s cluster. ### Mikado Graph ``` deploy-jobsync (goal) ├── build-jobsync-container │ └── mirror-jobsync └── integrate-jobsync-ollama ``` ### What is JobSync? Next.js app with SQLite for tracking job applications. Features resume management, application pipeline tracking, and AI-powered resume review/job matching. ### Key Decisions - **Ringtail k3s** (not minikube-indri) — colocates with Ollama for zero-latency AI - **Nix container** via `buildLayeredImage` — no Dockerfile, mirrors upstream source on forge - **Ollama for AI** — uses existing deployment, no API keys needed for AI features - **No upstream fork** — vanilla JobSync, Anthropic AI deferred to future work if needed ### Current Status Planning phase — cards committed, ready for review before implementation begins. Reviewed-on: https://forge.eblu.me/eblume/blumeops/pulls/288
2026-03-08 11:02:05 -07:00
## JobSync
- [[deploy-jobsync]]
- [[build-jobsync-container]]
Upgrade k8s forgejo-runner from v6.3.1 to v12.x (#249) ## Summary - C2 Mikado chain for upgrading the k8s forgejo-runner daemon (6 major versions behind) - Root goal card with two leaf prerequisites: workflow validation and config review - Ringtail runner is already at ~v12.6.4 via nixpkgs, no work needed there ## Mikado Chain ``` upgrade-k8s-runner (goal) ├── validate-workflows-against-v12 (leaf) └── review-runner-config-v12 (leaf) ``` Both leaves are actionable now. The biggest risk is workflow schema validation (introduced in v8/v9) rejecting our existing workflows. ## Next Steps Work the leaf nodes in a follow-up session, then attempt the goal. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Reviewed-on: https://forge.ops.eblu.me/eblume/blumeops/pulls/249
2026-02-22 17:12:45 -08:00
## Forgejo Runner
- [[upgrade-k8s-runner]]
- [[validate-workflows-against-v12]]
- [[review-runner-config-v12]]
Reference in a new issue Copy permalink